https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:43:10.950256+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-00001 bdu:2025-00001 2026-10-04T01:43:11.165287+00:00 bdu:2025-00001 https://cve.radiocsirt.org/vuln/bit-ceph-2024-48916 BIT-ceph-2024-48916 — Ceph is vulnerable to authentication bypass through RadosGW 2026-10-04T01:43:11.165327+00:00

Affected: Bitnami: ceph

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.

 https://cve.radiocsirt.org/vuln/euvd-2026-248751 EUVD-2026-248751 2026-10-04T01:43:11.165369+00:00 EUVD-2026-248751 https://cve.radiocsirt.org/vuln/fkie_cve-2024-48916 fkie_cve-2024-48916 2026-10-04T01:43:11.165384+00:00

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.

 https://cve.radiocsirt.org/vuln/msrc_cve-2024-48916 msrc_CVE-2024-48916 — Ceph is vulnerable to authentication bypass through RadosGW 2026-10-04T01:43:11.165407+00:00 msrc_CVE-2024-48916 https://cve.radiocsirt.org/vuln/oesa-2025-1206 OESA-2025-1206 — ceph security update 2026-10-04T01:43:11.165423+00:00

Affected: openEuler:22.03-LTS-SP4: ceph

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage. Security Fix(es):

A vulnerability in the Ceph Rados Gateway (RadosGW) OIDC provider allows attackers to bypass JWT signature verification by supplying a token with "none" as the algorithm (alg). This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid tokens without a signature.(CVE-2024-48916)

 https://cve.radiocsirt.org/vuln/rhsa-2024:10956 RHSA-2024:10956 — Red Hat Security Advisory: Red Hat Ceph Storage 8.0 security update 2026-10-04T01:43:11.165447+00:00

ceph: rhceph-container: Authentication bypass in CEPH RadosGW

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-48916 UBUNTU-CVE-2024-48916 2026-10-04T01:43:11.165464+00:00

Affected: Ubuntu:22.04:LTS: ceph, Ubuntu:24.04:LTS: ceph

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3688 WID-SEC-W-2024-3688 — Red Hat Enterprise Linux (Ceph Storage): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-04T01:43:11.165485+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux (Ceph Storage) ausnutzen, um Sicherheitsvorkehrungen zu umgehen.